# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. # SPDX-License-Identifier: Apache-2.0 --- description: | ### Document Name - ASR-AFSBP_1.0.0_EC2.1 ## What does this document do? This document changes all public EC2 snapshots to private ## Input Parameters * Finding: (Required) Security Hub finding details JSON * AutomationAssumeRole: (Required) The ARN of the role that allows Automation to perform the actions on your behalf. ## Documentation Links * [AFSBP EC2.1](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-standards-fsbp-controls.html#fsbp-ec2-1) schemaVersion: '0.3' assumeRole: '{{ AutomationAssumeRole }}' parameters: Finding: type: StringMap description: The input from the Orchestrator Step function for the EC2.1 finding AutomationAssumeRole: type: String description: (Required) The ARN of the role that allows Automation to perform the actions on your behalf. allowedPattern: '^arn:(?:aws|aws-us-gov|aws-cn):iam::\d{12}:role/[\w+=,.@-]+$' outputs: - Remediation.Output - ParseInput.AffectedObject mainSteps: - name: ParseInput action: 'aws:executeScript' outputs: - Name: FindingId Selector: $.Payload.finding_id Type: String - Name: ProductArn Selector: $.Payload.product_arn Type: String - Name: AffectedObject Selector: $.Payload.object Type: StringMap - Name: AccountId Selector: $.Payload.account_id Type: String - Name: TestMode Selector: $.Payload.testmode Type: Boolean inputs: InputPayload: Finding: '{{Finding}}' parse_id_pattern: '' resource_index: 2 expected_control_id: - 'EC2.1' Runtime: python3.8 Handler: parse_event Script: |- %%SCRIPT=common/parse_input.py%% isEnd: false - name: Remediation action: 'aws:executeAutomation' inputs: DocumentName: ASR-MakeEBSSnapshotsPrivate RuntimeParameters: AccountId: '{{ParseInput.AccountId}}' AutomationAssumeRole: 'arn:{{global:AWS_PARTITION}}:iam::{{global:ACCOUNT_ID}}:role/SO0111-MakeEBSSnapshotsPrivate' TestMode: '{{ParseInput.TestMode}}' isEnd: false - name: UpdateFinding action: 'aws:executeAwsApi' inputs: Service: securityhub Api: BatchUpdateFindings FindingIdentifiers: - Id: '{{ParseInput.FindingId}}' ProductArn: '{{ParseInput.ProductArn}}' Note: Text: 'EBS Snapshot modified to private' UpdatedBy: 'ASR-AFSBP_1.0.0_EC2.1' Workflow: Status: 'RESOLVED' description: Update finding isEnd: true